We traced the source back to an unauthorized wireless
router (D-Link 714P+, if it matters) plugged into a
live but unused network jack in a barely-accessible
location.
Before we had found the device, or ascertained its
type, we were able to sniff the switch port it was on,
and observed that it was pinging the network gateway
about once per second.

That doesn't sound like normal router behaviour to me.
Has anyone else seen such a device do this? Is this
something the intruder did to the router? (We have
suspicion, but not actual certainty, that the router
was placed by the same intruder as executed the network
attacks. So the attacker may have had to first compromise
the router to get access.)